Posted
by
kdawson
on Monday January 28, 2008 @07:54PM
from the say-it-ain't-so dept.

DaMan writes "Here's something that isn't an urban legend — Snopes, the popular urban legends reference site, has been pushing adware, for at least 6 months, to users via ads displayed on its Web site. No one seems to have called them on it until recently."

I read that comic too a few weeks ago, and did some research to try and verify it, but couldn't find any significant evidence.

I think humor is not your forte.

The joke is about Symantec and all of the other anti-virus/mal-ware companies. The urban legend is that they are in cahoots with the virus writers in order to keep their anti-virus business in business.

I think it is at least as true as the FBI looking the other way when their informants commit 'petty' crimes because they think that getting the big fish is worth it.

Humour is my forté. However, humour about the inner workings of anti-virus and mal-ware companies is still on my to-do list. Know any good stand up albums I should listen to? I hear Symantec Kinison is really good.:D

It's a non free software problem. Free software users don't have to download software from untrusted third parties. No closed source software can be trusted, so Windoze users who don't get software from Snopes ads should not feel so smug. There is very little difference between M$ and Zango.

Sheesh.

1: Unless you went through the code yourself, don't trust it. Maybe you can trust the maintainer of that code, but either way you end up trusting a third party.

2: Spelling it "Windoze" and "M$" just makes me think you're a moron. You're not a moron, are you? Why would you want me to think that?

3: Microsoft takes my money and gives me software that is as good or better than what I can get elsewhere. (Otherwise, I don't go to MS.) Zango would take my privacy, and give me... what, exactly? Third-

Spelling it "Windoze" and "M$" just makes me think you're a moron. You're not a moron, are you? Why would you want me to think that?

Hey, man, ease up. My bro there sounds like a mature man of 14 wise years. He's just tryin' to lay the truth on you, for real. He ain't gotta do no code review, he got that shizzle memorized, yo. He's pimpin that junk in binary, it ain't even on our level. True talk, he's down with the open source life-style like a mutha. He's the kind of real playa who's got spreadsheets printed out all over his bedsheets, in ODF format for sure.

Microsoft better watch out when he rolls deep with his leet skillz, he'll bust a cap in that closed source shiznit. Word.

Unless you went through the code yourself, don't trust it. Maybe you can trust the maintainer of that code, but either way you end up trusting a third party.

That's true to some extent. There is, however, a large difference. In closed software the third party you are trusting is often limited to the people who actually wrote the code. In open source software, you just have to trust that some people out of the many on the internet capable of understanding the code have actually looked at it, and that at least one of the people who looked at the code would call the project out on any suspect parts of the code. Personally, I'd say that the second set of assum

"Unless you went through the code yourself, don't trust it. Maybe you can trust the maintainer of that code, but either way you end up trusting a third party."
I've never read through Wiles's proof of the Fermat conjecture, but I'd still bet my life on its correctness, because I understand the process by which it was reviewed.
I don't claim free software is free of problems. But, other things being equal, I *do* trust code that I know could be publicly reviewed by anyone over code that couldn't be.

except for particularlly big projects there is little chance anyone outside of the project will bother to do an audit of the code and IMO there is little chance of someone looking at the code casually spotting a competantly inserted backdoor.

I'll field that one. My experience of people who seriously use terms like M$ or Windoze (or open sores for that matter) are generally either trolling, morons or fanatics (or some combination). In any of those cases, there seems to be little point to trying to have a constructive, reasoned argument with the person.

That is why I love Adblock + Noscript. I can set it up on even the most clueless user and not have to worry about them getting pwned before I even leave the driveway. And like you I had no idea that snopes even had ads. I have gotten so used to having the scripts blocked bar at the bottom of the screen I don't even notice it anymore. Now all I need is an easy way to integrate noscript and adblock into Kmeleon and I would be a happy camper!

I just tried to fill out their Contact Us page to ask them about their use of the Zango malware. My form submission threw an error on their server side ASP code. The really scary thing, look at the error message:

We'll see if any spam starts coming in to the (unique) address that I submitted to that form.

What this says to me though is that not only are they including JavaScript for an ad banner network, but their server side code is making references to 'zango' by name, implying a deeper relationship.

I think it's safe to assume for the time being that Snopes probably doesn't have your best interests at heart, and to not use an e-mail address that you care about if you choose to communicate with them.

I get the same result. I thought I had sent my complaint (reference this post [slashdot.org] via their web form, but upon clicking back over to that tab I noticed the same error you got. So, to contact them about Zango's abusive business practices, I have to install Zango's abusive software to interact with their server, or it generates an error? Wow. Somebody's smoking some good stuff at Snopes.
WHIOS has the following registry data for snopes.com:

The phone number appears to ring to offices at "best.com", who says their offices are presently closed and offer to take a message. Keying "best.com" into your browser will redirect to Verio [verio.com]. And round and round we go. I think I'll send a fax to the number listed in WHOIS.

Please let's not jump to conclusions.
Snopes has been a *good* site since way back.

Sure they don't have telephone access to their personal phone via whois. Do you? I sure the heck don't; I conceal my personal data. And poor snopes.com... running on Microsoft... my heart goes out to them. They don't know Linux, they're not power users like us. I am sure there is an explanation!!!

At one end of the chain, we have Content Provider A. At the other end of the chain, we have Service Provider Z. Z wants to place advertising on A's site but, importantly, doesn't know how to do it, doesn't generally know specifically who A is, and needs this to scale to potentially thousands of As. This is where participants B, C, D, E, F, Google, H... etc come in. There are advertising aggregators, affiliate networks, affiliates, affiliates of affiliates, affiliates of affilates of networks of affiliates who subdivide the advertising market into smaller and smaller slices before it finally gets on A's site.

Now, somewhere in the chain, let us inject one person who is less than scrupulous. He doesn't work at Snopes -- this would tarnish a brand for a week's worth of income, not a smart play. He probably has a steady stream of relationships with each of the numerous advertising concerns on the Internet, picking up and moving from one after he has collected a check or three and then had the banstick for TOS violations catch up with him. He is the one working for, most probably, affiliate of an affiliate of an affiliate of Zango.

This is the way most malware makes its way onto ad networks and, from there, onto high-trust sites. Volokh Conspiracy, one of my favorite blogs, had a nasty browser hijacker which affected non-US users for months before their advertising network caught wind of it. A few popular MMORPG sites have ended up hosting keyloggers in the same fashion. It is an unintended consequence of a system without central control -- much like the Internet itself, actually. (The system being split up this way does have its advantages, for both endpoints of the chain and for everybody between. Google's business model is based on snapping the chain and replacing it with a big cloud labeled Gooooooogle, but they're not yet the only game in town.)

A few days ago I posted a joking comment along the lines of, "What, Slashdot has ads? One of these days I need to browse without Adblock," and some jerk flamed me for being a freeloader. Well this is exactly why I go overkill with anti-adware programs.

Actually, for IE (in fact for anything on Windows) there's AdMuncher [admuncher.com] - its the one piece of software I've yet to find a good replacement for on the Mac, and I still miss it. Since it taps in at the network layer, it even filters things like MSN messenger just fine. Its also excellent at knowing which ads to just delete, which to replace with blank space, &c, in order to keep the page looking good.

This summary is somewhat misleading, since the user actually has to click the banner to install the software. Contrary to what the summary implies, Snopes does not perform drive-by downloads on its users. By the logic of this summary, tons of online publishers "push adware," since those "Free Virus Scan" ads are pretty ubiquitous...

But he does say that since people trust Snopes that the software appears to be enorsed by Snopes. Which would lead people to go ahead and install it.

So.. Snopes readers... Who are generally somewhat cautious, skeptical or suspicious sorts, if only because they're most likely there to debunk some urban legend that's been going around... Are going to blindly install a shady virus scanner from a pop-up window ad.

I'm sure there's an exception to prove the rule, but I just don't see it happening. The fact th

[i]Snopes readers... Who are generally somewhat cautious, skeptical or suspicious sorts, if only because they're most likely there to debunk some urban legend that's been going around... Are going to blindly install a shady virus scanner from a pop-up window ad.[/i]

Um, I don't send people to Snopes because they were cautious, skeptical, or suspicious. I send them to Snopes because they forwarded me an email about how a little girl in Indiana went missing and if you just forward it to your friends some company will donate $1 to the save the little girl fund or some garbage like that.

These are EXACTLY the type of people who will click on the flashy icon that says "Click here"

So.. Snopes readers... Who are generally somewhat cautious, skeptical or suspicious sorts, if only because they're most likely there to debunk some urban legend that's been going around... Are going to blindly install a shady virus scanner from a pop-up window ad.

I suspect that Snopes has two very distinct types of readers

The reasonably informed people who visit because its a well written site

The completely uninformed people who are there because the world is a scary place

The first group (which one presumes anyone here who visits Snopes falls into), are horrible people to make ad revenue off of. Our eyeballs are worth pratically nothing, so any marketing strategy they have might just as well not include us.

They most definitely are not. They put up "The Repository Of Lost Legends", or "TROLL" for short, where they posted a bunch of bogus claims and said it was true. They wanted to drive home the point that you shouldn't replace blindly believing what $LUSER says, with blindly believing what's on snopes. Well, they didn't do a very good job; they had to add a disclaimer after they started getting their own bogus posts as real. People had been spreading them.

Really, who does not know the difference between an advertisement and an endorsement? You're not that dumb, why assume everyone else is.

When a publication accepts an ad, that ad reflects on that publication. I have chosen to do business with companies specifically because of the reputation of the publications they advertise in. I trust those publications to filter acceptable ads for me, and only sell them to vendors who are worthy of the publication I'm reading.

I used to trust snopes. Based on this, meh, not so much any more. If they're willing to let their readers be duped for their profit, the veracity of the entire site is called i

A little on topic/a little bit just an excuse to blather about something in my mind since the Cloverfield [slashdot.org] story:

Folks in the ad game are in trouble. And I mean the folks using ads to sell another product and the folks selling the ads.

Apparently there was some sort of 'buzz' about Cloverfield for the past few months. I missed it. That may not be interesting, except I watch 2 to 3 hours of TV a day, spend more time than that on the web, subscribe to several popular (non-technical) magazines, and read a daily newspaper. I don't claim to have my finger on the pulse of pop culture, but I'm not quite ammish.

I vaguely remember a teaser-trailer (perhaps before Transformers?), but other than usual pre-release media push in the last few weeks, I know nothing of this buzz. If that's the state of advertising, then those folks are in trouble.

How does this tie in to the current topic? Well...Snopes has ads? I would guess it would since there's no subscription fee and would make a very strange charitable effort otherwise. But if Snopes has ads, I can't say I recall ever actually seeing one.

Seriously, for TV I have TiVo. For the web, there's ad buster and other tricks. For magazines, those ads are usually full page and very easy to recognize and skip without reading. For radio, there's NPR. Pretty much the only traditional advertising that gets my attention are bra ads in the daily paper. And those aren't even selling anything I might buy! (Unless the models are for sale.)

Apparently there was some sort of 'buzz' about Cloverfield for the past few months. I missed it. That may not be interesting, except I watch 2 to 3 hours of TV a day, spend more time than that on the web, subscribe to several popular (non-technical) magazines, and read a daily newspaper. I don't claim to have my finger on the pulse of pop culture, but I'm not quite ammish.

Mmmm, I don't watch nearly as much television as you do, and I've certainly seen numerous Cloverfield commercials. It's the only recent

Mmmm, I don't watch nearly as much television as you do, and I've certainly seen numerous Cloverfield commercials. It's the only recent movie I could have named.

The other poster was correct - there have been a few articles stating how Cloverfield was successful partly because of "buzz" created due to non-standard method of publicity since release of the teaser trailer...commercials on TV are the norm and that is all I know about as well. In fact, I would say that Cloverfield was advertised more than any

Apparently there was some sort of 'buzz' about Cloverfield for the past few months. I missed it. That may not be interesting, except I watch 2 to 3 hours of TV a day, spend more time than that on the web, subscribe to several popular (non-technical) magazines, and read a daily newspaper. I don't claim to have my finger on the pulse of pop culture, but I'm not quite ammish.

This is a bit off-topic, I know, but anyway: I have a Virgin Mobile phone. I paid very little for the phone and very little for the serv

I thought it was one of Intel's chipsets.Today's Sluggy Freelance [sluggy.com] references the movie too. I'd never heard of it. The poster is cut off in the frame, and just reads "rfield", and I was wondering if there was a new Garfield movie. With a shaky-cam. And I figured that would make me pretty ill too, but I was still pretty puzzled at the whole idea. Now I know.

(whaddya know, sluggy's down, so this post won't have a proper permalink, but that was pretty much the whole joke in the post above)

I get some sort of pop-up (which Firefox initally blocked) within a few refreshes of every time I clear the cookies on the browser. All the ones I've been getting are for Netflix and similarly decent companies, haven't seen the adware one yet.

Snopes, like most other sites using popups, sets a cookie the first time you visit, so you only get the popup once per some amount of time (however long until the cookie expires). Also, these days sites get around popup blockers these days by raising the popups on a mouse click event, instead of when you first visit the page. Try clicking on an empty area of the page to generate the popup (after you have cleared your cookies).

I can confirm that they do use popups as I got one from them just yesterday. Actually what I got was a pop-under, masquerading as a Windows dialog box, which is even worse. Snopes' advertising has become quite obnoxious, but their content is still good so I grudgingly put up with it. Incidentally, if you hate popunders as much as I do, please vote for https://bugzilla.mozilla.org/show_bug.cgi?id=369306 [mozilla.org] to kill them forever. (Don't add comments to the bug though, that's bad bugzilla etiquette)

If you don't like the ads a particular ad-server gives you, make sure they're unwelcome on your network, regardless of the site hosting the ads. I make sure fastclick.net (and about 150 other unsavory domains) resolve only to 0.0.0.0 at my DNS server. If you don't run your own DNS, OpenDNS [opendns.com] allows you to block specific domains as well.

I've been running adblockplus for quite a while now and have effectively forgotten about issues like this. So have most others who would get upset by it. Of course then I'll unknowingly send friends/family to sites such as snopes without a second thought about malware concerns. To me it looked like a nice wholesome/clean site.

I once emailed a funny video clip on a website to my wife - it had a mildly risque title, but wasn't NSFW at all, so I even mentioned that in the email. Little did I know that the clip was literally bracketed with loud, auto-playing flash-based porn ads (seriously). She was, to put it mildly, unthrilled.

Probably just a bad advertising provider than anything else.... I get the whole "check who provides your advertisements" thing, it's a duty of the webmaster and all - but wasn't there a case where a provider only showed malicious ads outside the country of origin? Or something? Is checking even reliable?
Ethical policy here would probably just be to poke Snopes.com via their forums first...

I'm sure I'm not the only one that would like to block Zango at the network level. Does anyone have the repository of information needed to create an effective block? I'm talking about RIR assignments, ASNs, SWIPed allocations, domain names, etc. Does anyone know of such a source? With this information I can ensure that none of my users ever have to put up with this Zango horse shit again.

You can start by blocking all of these 180solutions.com domains [robtex.com] with the method of your choice. Make sure to scroll down to get the list of related domains which ns1.180solutions.com answers authoritatively for. From a cursory glance, you're accomplishing a great deal just by dropping traffic to/from 64.94.137.0/25 and 66.150.14.0/25.

Isn't that what I implied? Why else would I have asked about ASNs and RIR allocations? I'm going to add Zango to my network sinkhole. With their ASN or netblocks I can define the next-hop as my sinkhole. The domain names will be used to let me pretend that they don't even exist on my NSs. Zero client config involved.

Given the earlier statement that a Wikipedia entry had been altered to hide the Snopes/Malware connection, it seems to me that it's unlikely the people running the site are unaware of the predatory advertising practice occurring under their aegis.

It might be Adblock Plus, then. It automatically prompts upon your first Firefox load (after installing the addon, of course) for a subscription server. After that, you don't need to touch a thing. I didn't know Snopes (or most sites for that matter) even ran ads until I saw this article.

I recommend using Adblock Plus [mozilla.org] andNoScript [noscript.net]. You can also add a modified hosts file [everythingisnt.com], though I find between ABP and NoScript, I no longer use the latter.

NoScript requires you to explicitly enable sites to run scripts, either per session or permanently. This turns people off, but security is never easy and it's just two clicks.

I dunno about 80% either but:About half of my gripe site traffic comes from/. (fat lot of good it does with the libertarian bias... damn, just insulted myself again).Of the/. crowd about 80% appear to use FF and of those the vast majority have ABP installed based on page hits with and page hits without ads pulled down. I assume the remaining 5% or so set ABP to download the ad but not render it.FWIW I don't try to make money on the add (It's for batteries, been up for a year or so, and I think I've made

Your helpful suggestions are well-intentioned, albeit misplaced, so I commend you for that. Twitter, however, has no credibility left here. Even the normal Windows-haters who speak up in discussions wouldn't consider him worth their time, I'd imagine.

Who needs adblock? I just run a stock Firefox, and visit Snopes regularly. Every once in a while a pop-up appears and is instantly squashed. I can't remember the last time I saw one stay up long enough to read what it was advertising.

Snopes isn't obscure--they're probably the most authoritative debunker of urban legends on the web. On the linked blog post, you can see several comments saying "I used to refer people to Snopes all the time when I got some glurge email."

The news part is the fact that it's actively being discussed on a site like Slashdot. Here's the note I just sent Snopes via their web contact form [snopes.com]:

As you are probably already aware, Slashdot is running a story (http://it.slashdot.org/article.pl?sid=08/01/29/0047236 [slashdot.org]) about malware being served up from advertisements hosted on your site. This malware appears to be in the form of misleading popup ads for Zango (http://en.wikipedia.org/wiki/Zango [wikipedia.org] | http://www.zango.com [zango.com]), which is a company with a long-standing track record of deceptive business practices (reference FTC settlement here: http://www.ftc.gov/opa/2006/11/zango.shtm [ftc.gov] [which they have mostly failed to learn from]). These ads are being served by the Fastclick ad network, which is operated by ValueClick Media (http://www.valueclickmedia.com/ [valueclickmedia.com]). I strongly object to any site profiting from these sort of irresponsible ads, and would like to see prompt action on the part of Snopes to remedy this situation. Thank you for your attention to this matter.

It's news on Slashdot... because it's news on Slashdot?Of course! The more something's posted on Slashdot, the greater the chance of it being posted on Slashdot. All original content is due to error on the part of the editors.

That's funny. I visited them and didn't see a thing. But then again my adblock filter has "media.fastclick.net/*" included.

My AdBlock filter doesn't have anything in it, plus I have popups enabled, and I too haven't been able to find this ad. Either they've already done something about it, or it's nearly as prevalent as TFA makes it sound.

I'd also like to add that TFA says "and by running this ad, Snopes, which is highly reputable, is providing an implied endorsement of the product." Seriously? Does anyone out there actually place any value at all on the choice of ads displayed on an otherwise free website? I don't honestly

If one reads their site information page they will find that Snopes claims that they intend to handle any claims of such ads.

We do our best to ensure the advertisements we carry on our site are as inoffensive as possible, and we try to filter out ads that flash bright colors, play (non-user-initiated) sounds, spawn multiple windows, automatically trigger downloads, install malware, or misleadingly claim readers have won contests or have been awarded free merchandise. Unfortunately, with several hundred di

I hate to tell you this but WOT, as great as it looks, will be turned into a tool used to promote spam and malware because it will give users a license to turn off their brains due to the opinions of the masses; masses that may be hired, or tricked by people who want to promote spam and malware. I haven't even gotten into the actual security aspects like how WOT determines which site it is rating if the page has frames/iframes. And, yes, I see that it relies on several different factors before giving a rati